Privacy & Cookie Policy

1. About this policy

This Privacy & Cookie Policy explains how RecruitOnline (“we”, “us”, “our”) collects, uses and protects personal information when you:

• visit www.recruitonline.io (the Website); or
• use our cloud software, mobile or desktop apps (the Service); or
• interact with us by email, social media or at events.

By accessing the Website or using the Service, you agree your information will be handled as described here.

2. The information we collect

Category	Details (examples, purpose, lawful basis*)
Account & contact data	Name, work email, job title → create/manage your account, provide support, send service notices. Lawful basis: Contract; Legitimate interest; Consent (for marketing).
Candidate / recruitment data	CVs, right-to-work docs (held on behalf of customers) → enable customer recruitment workflows. Lawful basis: Legitimate interest (processor role).
Technical data	IP address, device ID, log files → security, fraud prevention, product analytics. Lawful basis: Legitimate interest.
Location data (Employee App)	Confirm presence at worksite. Lawful basis: Legitimate Interest.
Payment data	Tokenised card details (via PCI-DSS gateway) → subscription billing. Lawful basis: Contract.
Marketing preferences	Opt-in/opt-out flags → respect communication choices. Lawful basis: Consent.

*Legal bases shown for GDPR/UK-GDPR; equivalent permissions apply under Australian Privacy Principles (APPs), NZ Privacy Act and CCPA/CPRA.

3. How we use your information

We use personal information to:

1. provide, secure and maintain the Service;
2. respond to enquiries and support requests;
3. send feature updates, security notices and (with consent) marketing messages;
4. personalise content and ads where cookies are enabled;
5. meet legal obligations (tax, fraud-prevention, court orders);
6. analyse aggregated trends to improve our products.

We never use Google Workspace API data to build or train general-purpose AI/ML models.

4. Automated decision-making & RecruitChatBot

Some clients enable an optional RecruitChatBot feature inside the Service.

• How it works - Candidates may complete a text-based pre-screening interview for each job they apply for. The ChatBot uses natural-language processing only to summarise the candidate’s responses and (if requested by the client) generate a preliminary relevance score for that specific role.
• Human-in-the-loop, with one configurable exception - Summaries and scores assist recruiters, who remain responsible for deciding whether to progress an application. Where a hiring agency enables it, an application may be automatically declined when the applicant’s own answers show an objective eligibility requirement for the role is not met (for example, no legal right to work in the relevant country). Candidates can request human review of any automated outcome.
• Why we offer it - Helps busy recruiters identify strong matches faster and lets candidates communicate more detail even when there are more applicants than interview slots.
• Your choices - Use of the ChatBot is optional. Candidates may apply via the standard form, and may request human review, an explanation of any relevance score, or correction of inaccuracies by emailing privacy@recruitonline.io.

5. Cookies & similar technologies

We use:

• Strictly necessary cookies - authentication, session management.
• Performance cookies - e.g. Google Analytics (IP anonymised).
• Functionality cookies - remember language, region.
• Advertising cookies / pixels - set only with your consent.

You can adjust cookie preferences via the banner or browser settings; blocking some cookies may affect site functionality.

6. Disclosures & international transfers

We share information only with:

• Affiliated companies within the RecruitOnline group;
• Trusted service providers (cloud hosting, analytics, payments), bound by contract;
• Authorities when legally required;
• Successors in a merger, acquisition or insolvency.

Data may be stored in Australia, New Zealand, the United States, the EU/UK and other jurisdictions. Transfers outside the EU/UK rely on approved contractual clauses or equivalent safeguards.

Adequacy “white-list” - Before transferring personal information overseas we check whether the destination is on the Australian Attorney-General’s adequacy list (providing privacy protection substantially similar to the APPs).

Safeguards for non-listed destinations - Where a country is not listed, we use enforceable contractual clauses, Binding Corporate Rules or another legally recognised safeguard.

Your rights - You may request a copy of relevant safeguards by emailing privacy@recruitonline.io.

7. Security measures

We employ encryption in transit and at rest, role-based access controls, multi-factor authentication for staff, and independent security testing under our ISO 27001 programme. No online service can guarantee absolute security; data transmission is at your own risk.

8. Data breach response

We follow the OAIC Notifiable Data Breach (NDB) scheme, EU/UK GDPR, and the Privacy Amendment Act 2024.

• Assessment - Suspected breaches are investigated immediately and assessed within 30 days.
• Notification - If an eligible breach is confirmed we will notify the OAIC, relevant regulators, affected individuals, and (if required) cooperate with any public disclosure ordered by the Minister.
• 24/7 contact - Report incidents to privacy@recruitonline.io
• Record keeping - All incidents and remedial steps are logged for at least 7 years.

9. Data retention

• Subscription & billing records - kept 7 years (statutory).
• Candidate data - retained in line with customer instructions.
• Marketing lists - removed on opt-out or after 24 months of inactivity.

On expiry or request we securely delete or anonymise data from active systems and backups, subject to legal holds.

10. Your privacy rights

Depending on your region you may have rights to access, correct, delete, port or object to processing of your personal information, and to complain to your supervisory authority (OAIC in Australia, ICO in the UK, or your EU authority).

Right to seek damages (Australia) - From 10 June 2025, you may sue for a serious invasion of privacy under the Privacy & Other Legislation Amendment Act 2024. We encourage you to contact us first at privacy@recruitonline.io so we can address concerns promptly.

Email privacy@recruitonline.io to exercise any rights. We will verify your identity and respond within statutory timeframes.

11. Candidate & Employee Apps - location data

Our time-and-attendance apps request precise or approximate location only at clock-in and clock-out to confirm presence at the worksite. Data is stored with the relevant time entry, never used for continuous tracking, and never shared with third parties. You may revoke permission in your device settings, but some features may stop working.

12. Children & young people

RecruitOnline services are designed for use by adults (jobseekers, recruiters, employers). We do not knowingly collect personal information from children under 16 years of age.

• If a minor applies - Recruiters are responsible for obtaining parental consent and verifying age. We provide tools or workflows to facilitate compliance.
• Upcoming Code - We will update our platform and this policy to comply with the Australian Children’s Online Privacy Code (expected 2026).
• Parents & guardians - If you believe we have collected a child’s data without consent, contact privacy@recruitonline.io and we will delete or de-identify it unless legally required to retain it.

13. Third-party links & integrations

The Website may contain links to third-party sites or services. Their privacy practices are outside our control. When you enable an integration (e.g. Gmail, Outlook, Workpro) we access data solely to provide the requested functionality, under that provider’s terms.

14. Business changes

If RecruitOnline is involved in a merger, acquisition, reorganisation or asset sale, personal information may be transferred and will remain subject to this policy.

15. Changes to this policy

We may update this document periodically. We will post the new version on the Website and, if changes are material, notify registered users by email or in-app message. Your continued use of the Website or Service after a revision constitutes acceptance of the updated policy.

16. Contact us

Questions or requests? Email privacy@recruitonline.io or write to:

Privacy Officer
RecruitOnline Holdings Pty Ltd
PO Box 475, Noosa Heads QLD, Australia